Malicious npm package tw-motion-css — full system compromise on install; no safe version exists
Severity: critical · Patch status: no-fix-needed · Since 2026-11-06
GitHub published a malware advisory (GHSA-chcp-mhw3-w5hq) on 2026-11-06 for the npm package tw-motion-css. All versions (= 0) are classified as malicious with no patched version available; the package embeds malicious code (CWE-506) and is considered to grant attackers full control of any machine where it is installed or running. Any computer with the package should be treated as fully compromised, with secrets and keys at risk of exfiltration. Because attackers may have established persistent outside access, removing the package does not guarantee removal of all malicious software. Affected users are any developers or CI systems that installed tw-motion-css; the only remediation is removal plus full credential rotation and host forensics/rebuild.
What to do
- Immediately stop using and remove tw-motion-css from all projects, lockfiles and CI caches
- Rotate all secrets, keys, tokens and credentials stored on or accessible from affected machines, from a clean computer
- Rebuild or thoroughly forensically clean affected hosts; assume persistence
- Audit npm dependency trees and CI logs for other installs of the package
- Review access logs and network egress for signs of attacker activity
Sources
All live incidents on Threat Watch
